5 min read
Encrypted DNS hides the question "what's the address for this site" from your provider. But the list of sites you open is still visible: the hostname travels in the clear inside the SNI field when your secure connection is established. That's the part missing from most "turn on DoH and become invisible" guides — encrypting DNS closes one of two holes.
An ordinary DNS query travels as plain text: your device asks your provider's server for the address of a site, and the question is visible to anyone along the path.
Both solve the same problem: removing the plain text from name lookups.
| What | Visible to your ISP | Why | |---|---|---| | The name you asked DNS about | no | the query is encrypted | | The IP address you connected to | yes | routing works on addresses | | The hostname in the SNI field | yes | sent in the clear when TLS is set up | | Page contents | no | covered by the site's encryption | | Volume and timing | yes | always visible |
The SNI row is the important one. When your browser connects to a site over HTTPS, it tells the server which domain it wants — before encryption is established. Encrypted Client Hello closes that field too, but it only works when both sides support it, and it isn't universal yet.
The practical conclusion: DoH by itself doesn't make your browsing history invisible to your operator. It prevents answer tampering and removes one leak channel, but it doesn't replace a tunnel.
What it doesn't do: bypass address-based blocking, defeat traffic inspection by protocol signature, or hide who you are from the site itself.
Android 9 and later: Settings → Network & internet → Private DNS → enter your DNS provider's hostname. That's DoT, applied system-wide.
iOS: no built-in toggle; DoH or DoT is enabled through a configuration profile or an app that installs one.
Browsers: Firefox and Chrome support DoH in their security settings — but that covers browser requests only, while other apps keep using the system resolver.
Router: configuring it there covers your whole home network, including devices with no settings of their own.
A properly built tunnel already solves the DNS problem: name lookups travel inside it and never reach your provider. Separate DoH is rarely needed while a VPN is running.
The dangerous combination is the reverse: a VPN that's on while its DNS queries leak outside the tunnel. Your provider then sees the list of sites even though the app shows a green icon. It's the most common leak, and it takes a minute to check: DNS leaks and how to test your VPN.
The full set of connection checks: how to check your VPN is working.
| Goal | Encrypted DNS is enough | You need a tunnel | |---|---|---| | Stop your ISP collecting your lookup history | yes | — | | Bypass DNS-based blocking | yes | — | | Bypass address-based blocking | no | yes | | Hide which sites you open | no: SNI remains | yes | | Change your visible country | no | yes | | Protect traffic on public Wi-Fi | partly | yes |
Name lookups are routed through the tunnel, so there's no separate encrypted DNS to configure: your provider sees neither the queries nor the hostname in the handshake, because the handshake itself happens inside the connection to the server. The protocol is VLESS with Reality masking — from the outside it looks like an ordinary web session. Confirming there's no leak takes a minute using the DNS leak guide.
Does DoH hide which sites I visit? Not entirely. The lookup is encrypted, but the hostname itself is sent in the clear in the SNI field when the connection to the site is established.
Which is better, DoH or DoT? DoH is harder to block because it's indistinguishable from ordinary web traffic. DoT runs on a dedicated port and is therefore easier to spot.
Do I need DoH if I'm using a VPN? Usually not: a proper tunnel already carries name lookups inside it. What matters more is confirming there's no DNS leak.
Does encrypted DNS bypass blocking? Only blocking that works by tampering with DNS answers. Against address blocking and traffic inspection it does nothing.
How do I check private DNS is working? Run a leak test: your provider's resolvers shouldn't appear in the results.
Best video calling messengers instead of WhatsApp & Telegram. Review of Zoom, Teams, Signal, FaceTime. Bypass blocks with BessyVPN - bessy.my More
Does a VPN keep logs and what can your ISP see? An honest look at VPN privacy and anonymity. BessyConnect on VLESS+Reality keeps no browsing logs. More
What a DNS leak is and how to run a dns leak test with your VPN on. Learn to check your VPN for leaks and fix them. BessyConnect — a private, leak-free VPN. More
